Splunk Search

How to use Splunk to detect web attacks with PHP IDS regex rules?

jeremyarcher
Path Finder

I'm noodling the thought of using Splunk to detect Web attacks (similarly to Scalp) via the Apache HTTP logs.

Scalp uses the PHP-IDS ruleset to find potential attacks. This ruleset is a series of regex strings used to search the Apache logs. I cannot link the file, but I suspect simply searching on phpidsrules.xml or default_filter.xml should turn up the file and the included regex strings.

However, I'm having some difficulties using the regex strings provided in the xml file to search the logs. I'm assuming that this is a difference between how Splunk handles regex an how php does.

Here is one example of a search that I'm attempting to use from the phpids rules:

sourcetype=access_combined_wcookie | regex _raw="(?:"[^"]*[^-]?>)|(?:[^\w\s]\s*\/>)|(?:>")"

This search produces the error:

Error in 'SearchParser': Missing a search command before '^'. Error at position '61' of search query 'search sourcetype=access_combined_wcookie | regex ...{snipped} {errorcontext = raw="(?:"[^"]*[^-]?>)}'. 
Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

This is not a regex problem per se, rather a string problem. Escape the double quotes within your expression with backslashes to stop them from terminating your regex string and you should be good.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

This is not a regex problem per se, rather a string problem. Escape the double quotes within your expression with backslashes to stop them from terminating your regex string and you should be good.

martin_mueller
SplunkTrust
SplunkTrust

Your question got me thinking "there might be a more generic use case in here" so I quickly whipped up the Regex IDS add-on: https://splunkbase.splunk.com/app/2805/

It's pre-loaded with PHPIDS rules for your convenience, other .json rule sets can be loaded instead. It's still very very rough around the edges, but the basics should work.

jeremyarcher
Path Finder

Wow Martin, that's fantastic. I'm sure I'm not the only person interested in this type of thing. Thanks from me and the community!

jeremyarcher
Path Finder

Thanks!

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...